Staff trained and acknowledged
A policy only works if everyone has read and accepted it.
Tax preparation offices · AI usage policy and governance
A clear AI policy your preparers will follow, built into your WISP
Preparers and front desk staff are already trying AI tools: drafting client emails, summarizing notices, asking about a tax rule. Some of that may involve client names, income figures or uploaded documents going into tools the office never approved. Meanwhile the written information security plan required under the FTC Safeguards Rule may not mention AI at all.
How it often works today
- Staff use free AI chat tools on personal accounts, sometimes pasting client details, with no record of what was shared.
- The office WISP was written from a template years ago and does not mention AI, cloud tools added since or the current vendor list.
- Nobody has checked whether AI features inside existing software, such as tax research or portal tools, use client data for training.
- Preparers are unsure whether AI-drafted explanations to clients need review, or who is responsible if they are wrong.
We would help you write a short, practical AI use policy and fold it into your WISP. It would list approved tools and uses, what client data may never be entered, how Section 7216 consent applies where return information is involved, what preparers must review and how new tools get approved. Then we would train staff on it before the season.
The improved workflow
Inventory current use
Ask staff which AI tools and features they already use and for what, without blame, and list AI features built into your existing software.
Review vendors and data flows
Check each tool's terms on data retention, training and access, and note where tax return information would go if used.
Write the policy
Write a short policy covering approved tools, permitted uses, prohibited data, Section 7216 consent where relevant, preparer review and how to request a new tool.
Update the WISP
Add the AI policy and current vendor list to your WISP, using IRS Publication 4557 and Publication 5708 as references, and confirm your qualified individual owns it.
Train and review
Train every staff member before the season, have them acknowledge the policy and review it each year alongside the rest of the WISP.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
AI tools in use that are on the approved list
Shows whether unapproved tool use is shrinking.
Time to approve or decline a new tool request
A slow process pushes staff back to unapproved tools.
Where people stay in control
- The owner and your designated qualified individual approve the policy and every tool on the approved list.
- Any AI output that reaches a client, such as an explanation or a drafted letter, is reviewed by a preparer first.
- The policy is an operational document, and the office confirms legal and regulatory points with its own advisers.
Example
Illustrative: an inventory that surprises the owner
For example, an eight-person office runs a short staff survey and finds four people using free AI chat tools, two of whom have pasted parts of IRS notices to get a summary. The office approves one business AI tool with data training turned off, bans client identifiers in anything else and adds the policy to its WISP. Every staff member signs it before January. This is an illustrative scenario.
Tools typically involved
What the first 30 days look like
In the first 30 days we would review your current WISP, survey staff on AI and cloud tool use, check vendor terms for tools already in use, draft the AI policy with your owner and qualified individual and plan training before the season.
Common questions
Does the FTC Safeguards Rule apply to small tax offices?
Tax preparers are generally covered as financial institutions under the Gramm-Leach-Bliley Act, and the IRS reminds preparers that a written information security plan is required. Some requirements vary with office size. Your own advisers should confirm how the rules apply to you, but most offices need a current, written WISP.
What does Section 7216 have to do with AI?
Section 7216 restricts how tax preparers use and disclose tax return information, and some uses require specific client consent. Sending return information to a third-party AI tool may raise questions under those rules, depending on the tool and the purpose. Get advice on your specific setup before using such tools with return data.
Should we just ban AI tools?
A blanket ban is simple but rarely holds, and it gives up useful time savings on tasks like drafting non-sensitive emails or summarizing public guidance. A short list of approved tools and clear rules about client data usually works better. Some offices reasonably decide to start very narrow and expand later.
The business case
Does it pay for itself?
Illustrative defaults for a tax preparation office. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
AI usage policy and governance in other industries
Accounting and CPA firmsArchitecture firmsFinancial advisory firmsLaw firmsMedical and specialty clinicsNonprofit organizations
AI usage policy and governance: full guide
Related guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small business
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.